Personal Token by Query Paramater

[laravel]

Personal Token by Query Paramater

Currently, the only way in Passport to pass your access token is through the Authorization header. Passing it through the query string is extremely dangerous, see here and here.

When using Passport as your guard, this is how you it checks for an authenticated user.

/**
 * Get the user for the incoming request.
 *
 * @param  Request  $request
 * @return mixed
 */
public function user(Request $request)
{
    if ($request->bearerToken()) {
        return $this->authenticateViaBearerToken($request);
    } elseif ($request->cookie('laravel_token')) {
        return $this->authenticateViaCookie($request);
    }
}

So bearer token explicitly checks for the authorization header, but the cookie method simply looks for the laravel_token cookie to be present during the request. The CreateFreshApiToken method sounds like it might work for you since you don't need to pass headers, just a simple cookie which the browser should handle automatically assuming your javascript doesn't have any problems.

That being said, that method also relies on how your intranet is setup and whether or not you have a "domain" which a cookie can be attached to.

[poxin13]

I do agree that it's dangerous and went ahead skipping that function completely in my project. I appreciate the information regarding the cookie, that may prove useful in the future. Went ahead and did a more regular method of authorization from the intranet app.